General
- Target e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593.apk
- Size 3.5MB
- Sample260820-pvwrcaxcka
- SHA256 e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593
- MD5 16a4cbdb16994f328003f63a8b16a1ab
- SHA1 87b027fa2a3bf188d5945720bc16dc1f9469cf77
- SHA512 09eaf20e4b27f012a2458fcd875db02eff6d500b9ef2d9c1a0b073591cef6d86f4a5e648e0dedc29c64b11d6a846cf27806972c0438f5eeba44e52c9b19b010f
- SSDEEP 98304:QrSSze0+HVciXp0wxsPgdsuGnRCCO+8Lz31JuhVEraCZRgqk:USSi0wciXp0w2JxRe+8H31QjO1k
- TLSH T1F5060193E32DA85FD9F786328A79522505574C654A53EB932E04B32C6DF7AC08F89FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593.apk
Resource
android-x86-arm-20260325-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593.apk
Resource
android-x64-20260325-en
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593.apk
Resource
android-x64-arm64-20260325-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593.apk
- Size 3.5MB
- SHA256 e1d12953bb1adc4ad04ded99f833935f60785f510cf87587cdc860866d8da593
- MD5 16a4cbdb16994f328003f63a8b16a1ab
- SHA1 87b027fa2a3bf188d5945720bc16dc1f9469cf77
- SHA512 09eaf20e4b27f012a2458fcd875db02eff6d500b9ef2d9c1a0b073591cef6d86f4a5e648e0dedc29c64b11d6a846cf27806972c0438f5eeba44e52c9b19b010f
- SSDEEP 98304:QrSSze0+HVciXp0wxsPgdsuGnRCCO+8Lz31JuhVEraCZRgqk:USSi0wciXp0w2JxRe+8H31QjO1k
- TLSH T1F5060193E32DA85FD9F786328A79522505574C654A53EB932E04B32C6DF7AC08F89FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks if the Android device is rooted.
-
Obtains sensitive information copied to the device clipboard
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries information about running processes on the device
Application may abuse the framework's APIs to collect information about running processes on the device.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Queries information about active data network
-
Queries the mobile country code (MCC)
MITRE ATT&CK Enterprise v16
MITRE ATT&CK Mobile v16
Tasks
static1
dropperloaderpersistence
Score
10/10
behavioral1
googledefense_evasiondiscoveryevasionimpactpersistencephishing
Score
10/10
behavioral2
googlecollectioncredential_accessdefense_evasiondiscoveryevasionimpactpersistencephishing
Score
10/10
behavioral3
googlecollectioncredential_accessdefense_evasiondiscoveryevasionimpactphishing
Score
10/10